The issue mainly lies in how to effectively simulate video codec attack, since the leading three kinds of attacks can be easily implemented by simple differentiable methods [1]}. As for image compression, many effective JPEG simulators have been proposed in the past literature, such as Diff-JPEG [2]}, MBRS [3]} and HiDDeN [1]}.
In contrast, there is no off-the-shelf differentiable video codec simulator so far. The reason is that many internal steps, such as motion estimation and compensation, are hard to be differentiated.
However, we find that JPEG and H.264 compression both share the process of DCT-based coefficient quantization, suggesting that losses introduced by video codec might share some common characteristics with those made by the rest of the attacks.
Therefore, we are motivated to design a video codec simulator by ensembling the attacked videos generated by blurring, scaling, JPEG compression, etc.
First, we use a real video codec to compress \(\mathbf {V}_\emph {ATK}\)  according to different coding standards and Constant Rate Factors (CRFs), i.e., \(\mathbf {V}_\emph {ATK}^{codec}=\emph {Real\_Codec}(\mathbf {V}_\emph {tmp},\emph {CRF})\) , where \(\emph {Real\_Codec}\)  is the H.264 codec, and \(\emph {CRF}=\lbrace 17,23,29\rbrace \) . Note that CRF is a tunable content-specific offset to the frame’s quantization parameter, with lower values indicating less compression and higher quality. We select the H.264 codec for its overwhelming popularity.
The attacked video by the video codec attack simulation is generated according to Eq. (REF ).
\(\begin{split}\hat{\mathbf {V}}_\emph {ATK}^{\emph {codec}}=&\alpha _{0}\cdot \emph {Resize}(\mathbf {V}_\emph {tmp})+\alpha _{1}\cdot \emph {Med}(\mathbf {V}_\emph {tmp})\\&+\alpha _{2}\cdot \emph {Gauss}(\mathbf {V}_\emph {tmp})+\alpha _{3}\cdot \emph {JPEG}(\mathbf {V}_\emph {tmp},\emph {QF}_W)\\&+\alpha _{4}\cdot \emph {JPEG}(\mathbf {V}_\emph {tmp},\emph {QF}_S),\end{split}\) 
